HP ProCurve 9304M Security Manual page 93

Figure 4.5 Multiple hosts connected to a single 802.1X-enabled port
The way the HP device authenticates Clients in a multiple-host configuration depends on the software release
running on the device:
• In releases prior to 07.8.00, services are provided on a port based on the authentication of a single Client.
When one Client is successfully authenticated, all hosts connected to the port are allowed access to the
network. The HP device forwards traffic from all of the connected hosts for as long as the authenticated Client
stays connected. When the authenticated Client disconnects from the network, authentication is removed for
the other connected hosts as well.
• Starting in release 07.8.00, if there are multiple hosts connected to a single 802.1X-enabled port, the HP
device authenticates each of them individually. Each host's authentication status is independent of the
others, so that if one authenticated host disconnects from the network, it has no effect on the authentication
status of any of the other authenticated hosts.
By default, traffic from hosts that cannot be authenticated by the RADIUS server is dropped in hardware. You
can optionally configure the HP device to assign the port to a "restricted" VLAN if authentication of the Client
is unsuccessful.
How 802.1X Multiple-Host Authentication Works (Release 07.8.00 and Later)
In release 07.8.00 and later, when multiple hosts are connected to a single 802.1X-enabled port on an HP device
(as in Figure 4.5), 802.1X authentication is performed in the following way:
1. One of the 802.1X-enabled Clients attempts to log into a network in which an HP device serves as an
Authenticator.
2. The HP device creates an internal session (called a dot1x-mac-session) for the Client. A dot1x-mac-
session serves to associate a Client's MAC address and username with its authentication status.
June 2005
Clients/Supplicants running 802.1X-compliant client software
Configuring 802.1X Port Security
RADIUS Server
(Authentication Server)
HP Device
(Authenticator)
Hub
4 - 7